About HHS

Active-fee-for-service contractors now have additional time to submit a DUA and SPI if they do not currently have a DUA and SPI on file. HHSC will notify contractors of the due date in a forthcoming notice.

Providers that have not yet submitted the DUA and SPI will receive information on an upcoming webinar/Q&A session, as well as a document including frequently asked questions pertaining to the DUA and SPI.

Adult Foster Care (AFC)

Community Living Assistance and Support Services/Continued Family Services (CLASS/CFS)

Community Living Assistance and Support Services/Case Management Services (CLASS/CMA)

Community Living Assistance and Support Services/Direct Services Agency (CLASS/DSA)

Community Living Assistance and Support Services/Support Family Services (CLASS/SFS)

Consumer Directed Services-Community Living Assistance and Support Services (CDS-CLASS)

Please note you are only required to submit one DUA and SPI per legal entity.

When completing the DUA:

Enter your legal entity name in both ("CONTRACTOR") fields on page 1.

HHS staff will provide Exhibit B, which will include all active contracts associated with your Tax Identification Number (TIN).

On page 11, please sign the 'By:' field and enter all requested information in the CONTRACTOR portion.

If you do not use a subcontractor, Attachment 1 is not required.

If you use a subcontractor, Attachment 1 must be completed.

Sign the 'By:' field and enter all requested information in the CONTRATOR portion and have your subcontractor sign and complete the SUBCONTRACTOR portion. If you use more than one subcontractor, additional Attachment 1s will need to be submitted.

Please note, original signatures are required.

The purpose of the DUA is to establish a clear and consistent process for safeguarding confidential information and for reporting and correcting any unauthorized use or disclosure of the confidential information. The DUA incorporates a variety of regulatory requirements under state and federal laws and is not limited to requirements for securing protected health information under the Health Insurance Portability and Accountability Act. It is meant to be broader and include protection for all types of non-public information that HHS's contractors access in the performance of their contractual obligations.

Under the terms of the DUA, contractors are required to identify Privacy and Security Officers to insure compliance with data protection and security. You should direct your questions to your designated officials. The federal Department of Health and Human Services offers resources and information online. The HHS SPI will enable HHS Information Security personnel to assess whether you have sufficient safeguards in place to protect HHS confidential information. Please be sure to review the instructions for completing the SPI online.

Please be advised that failure to implement all required protections within the applicable timelines may result in a vendor payment hold or termination.